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Amendments to the Specification 

Replace the paragraph beginning on page 12, lines 5-17, with: 

FIGURE 5 is a tree diagram showing, by way of example, the coalescing 
of rule parameters. A set of peer nodes 93a, 93b in intermediate layer 91 of a 
concast tree 90 forward a set of rule parameters 94, 95 respectively containing the 
network addresses 190.165.1.63 and 190.165.1.101. By implication, these rule 
parameters indicate that at least two of the packet validation devices 59-62 have 
non-validated packets received from separate "bad" hosts having a "source" 
address of 190.165.1.63 and 190.165. 1.101. The parent node 96 in the next 
intermediate layer 92 of the concast tree 90 coalesces these rule parameters 94, 95 
into a commonly identified network address space 190.165.1. XXX f thereby 
causing a non-validation of all packets originating from a commonly shared 
network address domain 97. In the described embodiment, rule parameters are 
coalesced upon the occurrence of at least four separately-identified network 
address spaces, although as few as two can suffice in some network environments. 

Replace the paragraph beginning on page 14, lines 1-11, with: 

Transiting network packets are processed in an iterative loop (blocks 121- 
127) as follows. First, if the packet contains rule parameters (block 123) and, by 
application of the vicinity affinity filter 100 (shown in FIGURE 6), the parameters 
are within the network domain of the packet validation device (block 123), the 
rule parameters are saved and applied to future packets transiting the packet 
validation device (block 124). Otherwise, if the packet does not contain a set of 
rule parameters (block 122), the packet is validated (block 125). If the packet is 
not validated by application of a parameterized validation rule (block 126), the 
rule parameter is sent (block 127) to the associated node 68a-d in the lowermost 
layer 64 of the concast tree 63. Processing continues for each subsequent packet 




^block 128\ after which processing terminates. 
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Replace the paragraph beginning on page 14, lines 12-26, with: 

FIGURE 8 is a flow diagram showing a method 140 for communicating 
coalesced rule parameters for a node in a concast tree in accordance with the 
5 present invention. The purpose of the method 140 is to process rule parameters 
received from either a packet validation device 59-62 (shown in FIGURE 3) or a 
child node from the next lower layer in the concast tree 63. Rule parameters are 
processed in an iterative loop (block 141-147) as follows. First, if the rule 
parameters are duplicated (block 142), the duplicate rule parameters are removed 

10 (block 143) and only a unique occurrence is forwarded to the next layer in the 
concast tree 63. Next, the rule parameters are coalesced (block 144) to 
consolidate any commonly identified address spaces (block 145) shared by two or 
more of the rule parameters. The consolidated rule parameter is forwarded to the 
next higher layer in the concast tree 63 or, if the node is the root node [[6]] 70, to 

15 the control center 67 (block 146). Processing of each successive rule parameter 
set continues (block 147) until all sets have been processed, after which the 
routine terminates. 
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